Re: Security in PHP+MYSQL
| From: | Richard Lynch | Date: | Thu, 16 Aug 2001 03:08:50 +0000 |
| Subject: | Re: Security in PHP+MYSQL | ||
| References: | 1 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-62954@lists.php.net to get a copy of this message | ||
> I have a security-question that I hope someone can answer, my question is:
> Will the DROP+TABLE+TBL_TEST-part in
> http://www.foo.bar/page.php?id=1;DROP+TABLE+TBL_TEST; be
> executed?
I don't think it will in CURRENT versions of MySQL.
Really *OLD* versions, maybe, if I recall correctly...
But you ought to be using:
http://php.net/mysql_escape_string
which may (or may not -- it's a little self-referential in the docs) detect
this inside a custom sanitize function.
Actually, for an id, you don't even need mysql_escape_string:
function sanitize_id($id){
$result = false;
$id_int = (int) $id;
$id_str = (string) $id_int;
if ($id_int && $id === $id_str){
$result = $id_int;
}
else{
$result = false;
}
return $result;
}
$id = sanitize_id($id) or error_log(date("Y/m/d h:i:s - " . __FILE__ . ": "
. _LINE__ . " hack attempt using \$id: $id");
if (!$id){
# Do whatever you want to tell the user you caught them (or not) here...
}
--
WARNING richard@zend.com address is an endangered species -- Use
ceo@l-i-e.com
Wanna help me out? Like Music? Buy a CD: http://l-i-e.com/artists.htm
Volunteer a little time: http://chatmusic.com/volunteer.htm